Input transformations: Adversarial perturbations can be alleviated by input pre-processing, such as JPEG compression [1]}, [2]}, bit-depth reduction [3]}, and randomized discretization [4]}, [5]}. MagNet [6]} resorts to auto-encoders to learn the distribution of normal inputs, and then uses the trained auto-encoder to purify the input samples.
